Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Rootkit infection D:


  • This topic is locked This topic is locked
24 replies to this topic

#1 louieisawsome

louieisawsome

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:12:25 PM

Posted 14 September 2009 - 05:55 PM

i been trying to fix this for a while and i cant i don't know if its multiple problems or what but Ive had a couple rouge anti-virus problems that i got rid of and after that my computer has been slow Ive had iexplore.exe open in the background and run videos and malware bytes starts scanning for about a second then closes and wont work until i reinstall it. same with like 5 other programs and i cant search Google or any any other search engines either i have to use proxys. d.d.s. wont work either. please help!


ROOTREPEAL AD, 2007-2009
==================================================
Scan Start Time: 2009/09/14 18:38
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xA831B000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xBA5EC000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA50DA000 Size: 49152 File Visible: No Signed: -
Status: -

Name: win32k.sys:1
Image Path: C:\WINDOWS\win32k.sys:1
Address: 0xBA398000 Size: 20480 File Visible: No Signed: -
Status: -

Name: win32k.sys:2
Image Path: C:\WINDOWS\win32k.sys:2
Address: 0xA86DA000 Size: 61440 File Visible: No Signed: -
Status: -

Stealth Objects
-------------------
Object: Hidden Module [Name: UACgxvmpcimte.dll]
Process: svchost.exe (PID: 864) Address: 0x00720000 Size: 77824

Object: Hidden Module [Name: UACybtrenjgmm.dll]
Process: svchost.exe (PID: 864) Address: 0x00ae0000 Size: 73728

Object: Hidden Module [Name: UACf1ec.tmpextavb.dll]
Process: svchost.exe (PID: 864) Address: 0x10000000 Size: 217088

Object: Hidden Module [Name: UACgxvmpcimte.dll]
Process: Explorer.EXE (PID: 936) Address: 0x10000000 Size: 77824

Object: Hidden Module [Name: UACwbxtextavb.dll]
Process: Iexplore.exe (PID: 15432) Address: 0x10000000 Size: 217088

Object: Hidden Module [Name: UACwbxtextavb.dll]
Process: Iexplore.exe (PID: 12936) Address: 0x10000000 Size: 217088

==EOF==

Edited by louieisawsome, 14 September 2009 - 08:41 PM.


BC AdBot (Login to Remove)

 


#2 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:25 AM

Posted 15 September 2009 - 07:06 PM

Hello! :(
My name is Sam and I will be helping you.

In order to see what's going on with your computer I will ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.




Please download and run Win32kDiag:
Download and run a batch file (peek.bat):
  • Download peek.bat from the download link below and save it to your Desktop.
  • Double-click peek.bat to run it.A black Command Prompt window will appear shortly: the program is running.
  • Once it is finished, copy and paste the entire contents of the Log.txt file it creates as a reply to this post.
==========

Please post the following logs in your next reply:

* Win32kDiag.txt
* Log.txt
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#3 louieisawsome

louieisawsome
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:12:25 PM

Posted 16 September 2009 - 11:22 AM

hey sam thanks for helping

Attached Files



#4 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:25 AM

Posted 16 September 2009 - 05:33 PM

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2
Link 3

Posted Image


Posted Image
--------------------------------------------------------------------

Double click on Combo-Fix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.

Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#5 louieisawsome

louieisawsome
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:12:25 PM

Posted 16 September 2009 - 08:30 PM

ok

Attached Files



#6 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:25 AM

Posted 17 September 2009 - 07:03 AM

Clearly you've run Combofix before. Please share with me how your computer is behaving now and what steps you've taken already.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#7 louieisawsome

louieisawsome
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:12:25 PM

Posted 17 September 2009 - 05:24 PM

i used avg anti rootkit to get rid of a uac rootkit and a win.32:1 and 2 or something. and i tried hijack this malware bytes advanced system care and aml registry cleaner but they all broke upon scanning and only work if i reinstall it and explorer is almost always frozen and when it does work and i click start usually the menu will stay on for like 5 min. and regular avg doesn't work and wont scan. i been trying to fix this for like a month.

#8 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:25 AM

Posted 17 September 2009 - 05:39 PM

If you would have shared that with me in the beginning we wouldn't have wasted so much time.

Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK.

"%userprofile%\desktop\win32kdiag.exe" -f -r

When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.


==================


We need to scan the system with this special tool.
  • Please download Junction.zip and save it.
  • Unzip it and put junction.exe in the Windows directory (C:\Windows).
  • Go to Start => Run... => Copy and paste the following command in the run box and click OK:

    cmd /c junction -s c:\ >log.txt&log.txt& del log.txt

    A command window opens starting to scan the system. Wait until a log file opens. Copy and paste or attach the content of it.

Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#9 louieisawsome

louieisawsome
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:12:25 PM

Posted 17 September 2009 - 08:50 PM

Log file is located at: C:\Documents and Settings\Compaq_Owner\Desktop\Win32kDiag.txt

Removing all found mount points.

Attempting to reset file permissions.

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...



Cannot access: C:\WINDOWS\system32\dumprep.exe

Attempting to restore permissions of : C:\WINDOWS\system32\dumprep.exe

[1] 2004-08-04 08:00:00 10752 C:\WINDOWS\$NtServicePackUninstall$\dumprep.exe (Microsoft Corporation)

[1] 2008-04-13 20:12:18 10752 C:\WINDOWS\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\dumprep.exe (Microsoft Corporation)

[1] 2004-08-04 08:00:00 10752 C:\WINDOWS\system32\dllcache\dumprep.exe (Microsoft Corporation)

[1] 2004-08-04 08:00:00 10752 C:\WINDOWS\system32\dumprep.exe (Microsoft Corporation)



Cannot access: C:\WINDOWS\system32\wbem\SET168.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SET168.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SET168.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\SET16A.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SET16A.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SET16A.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\SET1A.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SET1A.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SET1A.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\SET1D1.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SET1D1.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SET1D1.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\SET234.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SET234.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SET234.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\SET63F.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SET63F.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SET63F.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\SET64.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SET64.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SET64.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\SET67.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SET67.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SET67.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\SET93.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SET93.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SET93.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\SET9E.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SET9E.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SET9E.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\SETB2.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SETB2.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SETB2.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\SETF5.tmp

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\SETF5.tmp

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\SETF5.tmp ()



Cannot access: C:\WINDOWS\system32\wbem\wmiprvse.exe

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\wmiprvse.exe

[1] 2009-02-06 05:41:05 227840 C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 06:10:02 227840 C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 06:15:13 227840 C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\wmiprvse.exe (Microsoft Corporation)

[1] 2004-08-04 08:00:00 218112 C:\WINDOWS\$NtServicePackUninstall$\wmiprvse.exe (Microsoft Corporation)

[1] 2004-08-04 08:00:00 218112 C:\WINDOWS\$NtUninstallKB956572$\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 05:41:05 227840 C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 06:10:02 227840 C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 06:15:13 227840 C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\wmiprvse.exe (Microsoft Corporation)

[1] 2008-04-13 20:12:40 218112 C:\WINDOWS\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\dllcache\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 12:39:29 227840 C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation)



Cannot access: C:\WINDOWS\wmsetup.log

Attempting to restore permissions of : C:\WINDOWS\wmsetup.log

[1] 2009-09-10 06:44:01 643 C:\WINDOWS\wmsetup.log ()





Finished!

Attached Files

  • Attached File  Log.txt   4.33KB   4 downloads


#10 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:25 AM

Posted 18 September 2009 - 07:17 AM

We need to reset the permissions altered by the malware on some files.
  • Download this tool and save it: http://download.bleepingcomputer.com/sUBs/...xes/Inherit.exe
  • Copy and paste Inherit.exe to the same directory where the following files are located, then drag the file to the tool and drop it:

    c:\\Program Files\AVG\AVG8\avgcsrvx.exe
    c:\\Program Files\IObit\Advanced SystemCare 3\AWC.exe
    c:\\Program Files\IObit\IObit Security 360\a_hijackscan.exe
    c:\\Program Files\Malwarebyte anti bleep\mbam.exe
    c:\\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    c:\\Program Files\Norton Security Scan\Engine\2.3.0.44\Nss.exe
    c:\\Program Files\Trend Micro\Hijack\HijackThis.exe
    c:\\Program Files\Windows Defender\MsMpEng.exe

  • when finished click OK. You may remove the Inherit.exe from the directory.

Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#11 louieisawsome

louieisawsome
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:12:25 PM

Posted 18 September 2009 - 02:02 PM

it didnt work with any of them. i copied it there then draged it onto the programs and it still said that i dont have the appropriate permissions to do that. :(

#12 louieisawsome

louieisawsome
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:12:25 PM

Posted 19 September 2009 - 12:24 PM

it worked but instead of closing it freezes

#13 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:25 AM

Posted 19 September 2009 - 04:53 PM

Run this command again and post the log that opens up.

cmd /c junction -s c:\ >log.txt&log.txt& del log.txt
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#14 louieisawsome

louieisawsome
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:12:25 PM

Posted 19 September 2009 - 06:22 PM

Junction v1.05 - Windows junction creator and reparse point viewer
Copyright © 2000-2007 Mark Russinovich
Systems Internals - http://www.sysinternals.com


Failed to open \\?\c:\\hiberfil.sys: The process cannot access the file because it is being used by another process.



Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process.


...
Failed to open \\?\c:\\Documents and Settings\Louie: Access is denied.




...

...

...

...

..
Failed to open \\?\c:\\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\12fc5213d9182dc4358fe6f9197ab5d1_58a5e215-add6-4813-b2ee-2b63d612d970: Access is denied.



Failed to open \\?\c:\\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8d65b1f830a114ab330887cff9f40022_58a5e215-add6-4813-b2ee-2b63d612d970: Access is denied.



Failed to open \\?\c:\\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9b95a0058f0648f6622d71c2965a7656_58a5e215-add6-4813-b2ee-2b63d612d970: Access is denied.


.

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...


Failed to open \\?\c:\\Program Files\AVG\AVG8\avgcsrvx.exe: Access is denied.


...

...

...

...

...

...

...

...

...

...


Failed to open \\?\c:\\Program Files\InstallShield Installation Information\{0F5D09A0-B813-11D1-941E-000021000018}\setup.ilg: Access is denied.



Failed to open \\?\c:\\Program Files\InstallShield Installation Information\{3D047C15-C859-45F7-81CE-F2681778069B}\Setup.ilg: Access is denied.



Failed to open \\?\c:\\Program Files\InstallShield Installation Information\{867AE74B-855F-4ABD-BCA1-7B4C0ECF2DD9}\setup.ilg: Access is denied.



Failed to open \\?\c:\\Program Files\InstallShield Installation Information\{930B2432-43D4-11D5-9871-00C04F8EEB39}\setup.ilg: Access is denied.



Failed to open \\?\c:\\Program Files\InstallShield Installation Information\{BD57EA4D-026E-4F08-9B93-080E282B81FE}\Setup.ilg: Access is denied.



Failed to open \\?\c:\\Program Files\InstallShield Installation Information\{D2A0F8F4-CE50-4857-A21C-3061682B2E87}\setup.ilg: Access is denied.


...
Failed to open \\?\c:\\Program Files\IObit\IObit Security 360\a_hijackscan.exe: Access is denied.




...

...

...

..
Failed to open \\?\c:\\Program Files\Malwarebyte anti bleep\mbam.exe: Access is denied.



Failed to open \\?\c:\\Program Files\Malwarebytes' Anti-Malware\mbamm.exe: Access is denied.


.

...

.
Failed to open \\?\c:\\Program Files\Norton Security Scan\Engine\2.3.0.44\Nss.exe: Access is denied.


..

...

...

..
Failed to open \\?\c:\\Program Files\Spybot - Search & Destroy\SpybotSD.exe: Access is denied.


.

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

..
Failed to open \\?\c:\\Program Files\Trend Micro\Hijack\HijackThis.exe: Access is denied.



Failed to open \\?\c:\\Program Files\Trend Micro\HijackThi\HijackThis.exe: Access is denied.



Failed to open \\?\c:\\Program Files\Trend Micro\HijackThis\HijackThis.exe: Access is denied.



Failed to open \\?\c:\\Program Files\Trend Micro\HijackThiss\HijackThis.exe: Access is denied.


.

...


Failed to open \\?\c:\\Program Files\Windows Defender\MsMpEng.exe: Access is denied.


...

...

...

...

...

...


Failed to open \\?\c:\\System Volume Information\MountPointManagerRemoteDatabase: Access is denied.


...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

.No reparse points found.

#15 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:11:25 AM

Posted 20 September 2009 - 10:47 AM

Let's try this a different way.
  • Download this tool and save it to the desktop: http://download.bleepingcomputer.com/sUBs/...xes/Inherit.exe
  • Go to Start => Run => Copy and paste the first line of the following lines in the run box and click OK:


    "%userprofile%\desktop\inherit" "c:\Program Files\Windows Defender\MsMpEng.exe"

    "%userprofile%\desktop\inherit" "c:\Program Files\Trend Micro\Hijack\HijackThis.exe"

    "%userprofile%\desktop\inherit" "c:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

    "%userprofile%\desktop\inherit" "c:\Program Files\Norton Security Scan\Engine\2.3.0.44\Nss.exe"

    "%userprofile%\desktop\inherit" "c:\Program Files\Malwarebytes' Anti-Malware\mbamm.exe"

    "%userprofile%\desktop\inherit" "c:\Program Files\Malwarebyte anti bleep\mbam.exe"

    "%userprofile%\desktop\inherit" "c:\Program Files\IObit\IObit Security 360\a_hijackscan.exe"

    "%userprofile%\desktop\inherit" "c:\Program Files\AVG\AVG8\avgcsrvx.exe"

  • If you get a security warning select Run.
  • You will get a "Finish" popup. Click OK.
  • Do the same for the rest of the lines until you have run all the above commands one by one.

Let me know how that goes and if it resolves your problem.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users